From: Antoine Pitrou <solipsis@pitrou.net>
Date: Sun, 11 Oct 2009 21:03:26 +0000 (+0000)
Subject: Issue #7084: Fix a (very unlikely) crash when printing a list from one
X-Git-Tag: v2.7a1~373
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=beaf6a02f45fe667ddcb1fbdd24f1ea7189b2105;p=python

Issue #7084: Fix a (very unlikely) crash when printing a list from one
thread, and mutating it from another one.  Patch by Scott Dial.
---

diff --git a/Misc/ACKS b/Misc/ACKS
index 6383a46a3a..c8f80e6c24 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -175,6 +175,7 @@ Arnaud Delobelle
 Erik Demaine
 Roger Dev
 Raghuram Devarakonda
+Scott Dial
 Toby Dickenson
 Mark Dickinson
 Jack Diederich
diff --git a/Misc/NEWS b/Misc/NEWS
index 42a8cd9ba7..9fc3edc350 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.7 alpha 1
 Core and Builtins
 -----------------
 
+- Issue #7084: Fix a (very unlikely) crash when printing a list from one
+  thread, and mutating it from another one.  Patch by Scott Dial.
+
 - Issue #1571184: The Unicode database contains properties for more characters.
   The tables for code points representing numeric values, white spaces or line
   breaks are now generated from the official Unicode Character Database files,
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 98d7e47354..c5b1475802 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -319,6 +319,7 @@ list_print(PyListObject *op, FILE *fp, int flags)
 {
 	int rc;
 	Py_ssize_t i;
+	PyObject *item;
 
 	rc = Py_ReprEnter((PyObject*)op);
 	if (rc != 0) {
@@ -333,15 +334,19 @@ list_print(PyListObject *op, FILE *fp, int flags)
 	fprintf(fp, "[");
 	Py_END_ALLOW_THREADS
 	for (i = 0; i < Py_SIZE(op); i++) {
+		item = op->ob_item[i];
+		Py_INCREF(item);
 		if (i > 0) {
 			Py_BEGIN_ALLOW_THREADS
 			fprintf(fp, ", ");
 			Py_END_ALLOW_THREADS
 		}
-		if (PyObject_Print(op->ob_item[i], fp, 0) != 0) {
+		if (PyObject_Print(item, fp, 0) != 0) {
+			Py_DECREF(item);
 			Py_ReprLeave((PyObject *)op);
 			return -1;
 		}
+		Py_DECREF(item);
 	}
 	Py_BEGIN_ALLOW_THREADS
 	fprintf(fp, "]");